@stevecastaneda/paseo-progress 1.14.0 → 1.14.1

package/README.md

@@ -80,7 +80,7 @@ The choice covers every worktree of the repo and is kept in the repo's local git
 
 ### Upgrading from 0.1.x
 
-Earlier versions kept progress in `.scratch/` in each worktree, hidden by a `.scratch/.gitignore` they wrote. The first time the command or the panel touches a worktree after the upgrade, the plugin moves its files out of `.scratch/` and removes that `.gitignore` if it's exactly the one the plugin wrote. If `.scratch/` is then empty, it goes too; anything else you keep there stays. If git tracks the old progress file (for example, an agent committed it), the plugin leaves it where it is and keeps using it, so nothing changes in that repo.
+Versions before 0.2.0 kept progress in `.scratch/` in each worktree. From 1.14.1, Progress never reads, moves or changes the files those versions left there, so such a run no longer shows in the panel. The file stays where it is. Versions 0.2.0 to 1.14.0 moved such a run outside the repo the first time they opened the worktree.
 
 ## Agent tools
 
@@ -178,6 +178,12 @@ The progress file, `progress.jsonl`, holds one JSON event per line, each with a
 
 ## Changelog
 
+### 1.14.1
+
+- [Fixed] **Run history stays in its folder.** This fixes a security issue in saving run history. Progress now saves a run only when the dashboard can read the line that started it, and only into a folder inside the repo and outside `.git`.
+- [Fixed] **HTML previews keep ignored files and `.git` out.** This fixes a security issue in the HTML preview. No preview gets files in `.git` written into it, and a page that git tracks no longer gets files git ignores, like a `.env`. A page in an ignored folder, like an agent's report in `.scratch`, still shows the files in its own folder and the folders below it. If git can't run in the repo, a preview shows the page without the files it loads from the repo.
+- [Fixed] **Progress no longer reads its old files in `.scratch`.** This fixes a security issue in how Progress handled a run that version 0.1.x left in `.scratch`. Progress now keeps its files outside the repo for every worktree and never reads, moves or changes the files 0.1.x left there. A 0.1.x run that was never opened since 0.2.0 stays there and no longer shows in the panel.
+
 ### 1.14.0
 
 - [New] **Agents can record progress with Paseo tools.** On Paseo 0.14 and later, Progress hands agents a tool for each common command, like `progress_ticket_update` and `progress_question_ask`. Nothing needs installing, and every update names the agent that sent it. Agents get them once you turn on **Settings → your host → Agents → Enable Paseo tools**, which also lets them start, message and stop other agents. **Agent tools** in Progress settings shows whether it's on and how to turn it on. The skill now uses the tools when an agent has them and the `paseo-progress` command otherwise, so Paseo 0.13 and agents without the tools work as before.

package/dist/server/cli.js

@@ -19706,7 +19706,6 @@ var QUESTION_MODE_RULES = {
 // shared/events.ts
 var PROGRESS_FILE_NAME = "progress.jsonl";
 var PANEL_OPENED_NAME = "progress-panel-opened";
-var LEGACY_FOLDER = ".scratch";
 var EVENT_VERSION = 1;
 var TICKET_STATUSES = ["not_started", "working", "blocked", "done", "skipped"];
 var ticketStatusSchema = external_exports.enum(TICKET_STATUSES);
@@ -20270,10 +20269,16 @@ import { dirname, isAbsolute, join as join2, resolve, sep } from "node:path";
 function outside(inside) {
   return inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside);
 }
+function inGitFolder(inside) {
+  return inside.split(/[\\/]/).some((name) => name.toLowerCase() === ".git");
+}
+function hasGitEntry(directory) {
+  return existsSync(join2(directory, ".git"));
+}
 function findRoot(cwd) {
   let directory = resolve(cwd);
   while (true) {
-    if (existsSync(join2(directory, ".git"))) return directory;
+    if (hasGitEntry(directory)) return directory;
     const parent = dirname(directory);
     if (parent === directory) return resolve(cwd);
     directory = parent;
@@ -20385,33 +20390,33 @@ async function installLauncher(path, platform = process.platform) {
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
-import { appendFile as appendFile2, mkdir as mkdir4, readdir, readFile as readFile3, rename, rm as rm2, rmdir, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { lstat, mkdir as mkdir4, readdir, realpath, rename, rm as rm2, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { basename as basename2, dirname as dirname3, join as join4, normalize, resolve as resolve2 } from "node:path";
+import { basename as basename2, dirname as dirname3, join as join4, normalize, resolve as resolve2, sep as sep2 } from "node:path";
 import { promisify } from "node:util";
-var LOCK_NAME2 = `${PROGRESS_FILE_NAME}.lock`;
 var SAVE_RUNS_KEY = "paseo-progress.saveRuns";
-var LEGACY_GITIGNORE = `# Added by the progress plugin for Paseo so its files stay out of git.
-${PROGRESS_FILE_NAME}
-${LOCK_NAME2}/
-${PANEL_OPENED_NAME}
-.gitignore
-`;
-async function git(cwd, args) {
+async function git(root, args) {
   try {
-    const { stdout } = await promisify(execFile)("git", args, { cwd });
+    const { stdout } = await promisify(execFile)("git", ["-C", resolve2(root), ...args], { cwd: dirname3(process.execPath) });
     return { code: 0, stdout };
   } catch (error62) {
     const failed = error62;
     return { code: typeof failed.code === "number" ? failed.code : -1, stdout: failed.stdout ?? "" };
   }
 }
-async function exists2(path) {
-  return Boolean(await stat3(path).catch(() => null));
-}
 function stateRoot(home = homedir()) {
   return join4(home, ".local", "state", "paseo-progress");
 }
+async function writeAtomic(path, text2) {
+  await mkdir4(dirname3(path), { recursive: true });
+  const temp = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile3(temp, text2);
+    await rename(temp, path);
+  } finally {
+    await rm2(temp, { force: true });
+  }
+}
 function outsideDirectory(root, home = homedir()) {
   let real = root;
   try {
@@ -20421,51 +20426,18 @@ function outsideDirectory(root, home = homedir()) {
   const hash2 = createHash("sha1").update(real).digest("hex").slice(0, 8);
   return join4(stateRoot(home), `${basename2(real)}-${hash2}`);
 }
-var trackedLegacy = /* @__PURE__ */ new Map();
-async function legacyTracked(root, mtimeMs) {
-  const cached2 = trackedLegacy.get(root);
-  if (cached2 && cached2.mtimeMs === mtimeMs) return cached2.tracked;
-  const { code } = await git(root, ["ls-files", "--error-unmatch", "--", `${LEGACY_FOLDER}/${PROGRESS_FILE_NAME}`]);
-  trackedLegacy.set(root, { mtimeMs, tracked: code === 0 });
-  return code === 0;
-}
-async function findStore(root, home = homedir()) {
+function findStore(root, home = homedir()) {
   const directory = outsideDirectory(root, home);
-  const store = { directory, shown: directory.startsWith(home) ? `~${directory.slice(home.length)}` : directory };
-  const legacy = join4(root, LEGACY_FOLDER);
-  const info = await stat3(join4(legacy, PROGRESS_FILE_NAME)).catch(() => null);
-  if (!info) return store;
-  if (await legacyTracked(root, info.mtimeMs)) return { directory: legacy, shown: LEGACY_FOLDER };
-  await moveLegacy(legacy, directory);
-  return store;
-}
-async function moveLegacy(legacy, directory) {
-  await mkdir4(directory, { recursive: true });
-  await withLock(join4(legacy, LOCK_NAME2), async () => {
-    const text2 = await readFile3(join4(legacy, PROGRESS_FILE_NAME), "utf8").catch(() => null);
-    if (text2 === null) return;
-    await withLock(join4(directory, LOCK_NAME2), async () => {
-      const current = await readFile3(join4(directory, PROGRESS_FILE_NAME), "utf8").catch(() => "");
-      const lead = current && !current.endsWith("\n") ? "\n" : "";
-      await appendFile2(join4(directory, PROGRESS_FILE_NAME), `${lead}${text2}`);
-    });
-    await rm2(join4(legacy, PROGRESS_FILE_NAME));
-    if (await exists2(join4(legacy, PANEL_OPENED_NAME))) {
-      await writeFile3(join4(directory, PANEL_OPENED_NAME), "");
-      await rm2(join4(legacy, PANEL_OPENED_NAME));
-    }
-  });
-  const ignore = await readFile3(join4(legacy, ".gitignore"), "utf8").catch(() => null);
-  if (ignore === LEGACY_GITIGNORE) await rm2(join4(legacy, ".gitignore"));
-  await rmdir(legacy).catch(() => {
-  });
+  return { directory, shown: directory.startsWith(home) ? `~${directory.slice(home.length)}` : directory };
 }
 var configFiles = /* @__PURE__ */ new Map();
 var savedFolders = /* @__PURE__ */ new Map();
 async function configFile(root) {
+  if (!hasGitEntry(root)) return null;
   if (!configFiles.has(root)) {
     const { code, stdout } = await git(root, ["rev-parse", "--git-common-dir"]);
-    configFiles.set(root, code === 0 ? join4(resolve2(root, stdout.trim()), "config") : null);
+    if (code !== 0) return null;
+    configFiles.set(root, join4(resolve2(root, stdout.trim()), "config"));
   }
   return configFiles.get(root);
 }
@@ -20476,10 +20448,19 @@ async function historyFolder(root) {
   const cached2 = savedFolders.get(file2);
   if (cached2 && cached2.mtimeMs === mtimeMs) return cached2.folder;
   const { stdout } = await git(root, ["config", "--get", SAVE_RUNS_KEY]);
-  const folder = stdout.trim() || null;
+  const checked = checkFolder(stdout);
+  const folder = "folder" in checked ? checked.folder : null;
   savedFolders.set(file2, { mtimeMs, folder });
   return folder;
 }
+function checkFolder(raw) {
+  const trimmed = raw.trim().replace(/\/+$/, "");
+  if (!trimmed) return { error: "Choose a folder" };
+  const folder = normalize(trimmed);
+  if (outside(folder) || folder === ".") return { error: "Choose a folder inside the repo" };
+  if (inGitFolder(folder)) return { error: "Choose a folder outside .git" };
+  return { folder };
+}
 function runFileName(startedAt, title) {
   const stamp = startedAt.replace(/\.\d+Z$/, "").replace(/[-:]/g, "").replace("T", "-");
   const slug = title.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
@@ -20488,29 +20469,27 @@ function runFileName(startedAt, title) {
 async function saveRunCopy(root, text2) {
   const folder = await historyFolder(root);
   if (!folder) return;
-  const lines = text2.split("\n").filter((line) => line.trim());
-  let start = -1;
-  let event = null;
-  for (let index = lines.length - 1; index >= 0; index--) {
-    try {
-      const parsed = JSON.parse(lines[index]);
-      if (parsed?.type === "run.start") {
-        start = index;
-        event = parsed;
-        break;
-      }
-    } catch {
-    }
-  }
-  if (start < 0 || !event?.ts || !event.title) return;
-  const directory = join4(root, folder);
-  await mkdir4(directory, { recursive: true });
-  await writeFile3(join4(directory, runFileName(event.ts, event.title)), `${lines.slice(start).join("\n")}
+  const [start] = latestRun(parseProgress(text2).events);
+  if (start?.event.type !== "run.start") return;
+  const lines = text2.split("\n").slice(start.line - 1).filter((line) => line.trim());
+  const directory = await runsFolder(root, folder);
+  if (!directory) return;
+  await writeAtomic(join4(directory, runFileName(start.event.ts, start.event.title)), `${lines.join("\n")}
 `);
 }
+async function runsFolder(root, folder) {
+  let directory = await realpath(root);
+  for (const name of folder.split(sep2)) {
+    directory = join4(directory, name);
+    const info = await lstat(directory).catch(() => null);
+    if (!info) await mkdir4(directory);
+    else if (!info.isDirectory()) return null;
+  }
+  return directory;
+}
 
 // server/question-mode.ts
-import { readFile as readFile4, rm as rm3 } from "node:fs/promises";
+import { readFile as readFile3, rm as rm3 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { join as join5 } from "node:path";
 var mirrorSchema = external_exports.object({ questionMode: external_exports.enum(QUESTION_MODES) });
@@ -20519,7 +20498,7 @@ function questionModePath(home = homedir2()) {
 }
 async function readQuestionMode(home = homedir2()) {
   try {
-    return mirrorSchema.parse(JSON.parse(await readFile4(questionModePath(home), "utf8"))).questionMode;
+    return mirrorSchema.parse(JSON.parse(await readFile3(questionModePath(home), "utf8"))).questionMode;
   } catch {
     return DEFAULT_QUESTION_MODE;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stevecastaneda/paseo-progress",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "A live progress dashboard per worktree for Paseo, drawn from a file agents write with the Progress tools or the paseo-progress command.",
   "license": "MIT",
   "author": "Steve Castaneda",

package/server/open.ts

@@ -8,8 +8,8 @@ import { promisify } from "node:util";
 import { findAttachment, type FolderEntry, imageMimeType, isPieced, type PiecedKind, previewKind, splitRef, textFormat, videoMimeType } from "../shared/attachments.ts";
 import { prepareMarkdown, previewText } from "../shared/markdown.ts";
 import { readProgress } from "./progress-file.ts";
-import { findRoot, outside } from "./paths.ts";
-import { findStore } from "./store.ts";
+import { findRoot, hasGitEntry, inGitFolder, outside } from "./paths.ts";
+import { findStore, git } from "./store.ts";
 
 export type Opener = (path: string) => Promise<void>;
 
@@ -127,7 +127,7 @@ export async function previewDeliverable(directory: string, id: string): Promise
     }
   }
   if (size > MAX_PREVIEW_BYTES) throw new Error(tooLarge(path, size));
-  if (kind === "html") return { kind, html: await inlineLocalFiles(await readFile(realTarget, "utf8"), dirname(realTarget), realRoot), bytes: size };
+  if (kind === "html") return { kind, html: await inlineLocalFiles(await readFile(realTarget, "utf8"), realTarget, realRoot), bytes: size };
   const data = await readFile(realTarget);
   return { kind, dataUri: `data:${imageMimeType(realTarget)};base64,${data.toString("base64")}`, bytes: size };
 }
@@ -146,8 +146,29 @@ async function listFolder(target: string): Promise<{ entries: FolderEntry[]; tru
 // The preview gets only the page, so the files beside it that it loads (its
 // screenshots, a script, a stylesheet) are written into it. Only files inside the
 // worktree, up to MAX_PREVIEW_BYTES in all; anything else is left as written and
-// fails to load. Web addresses are left alone.
-async function inlineLocalFiles(html: string, directory: string, root: string): Promise<string> {
+// fails to load. Web addresses are left alone. A cloned repo's page runs here,
+// so it must not read and send .env or .git files: it gets a file git says it
+// keeps, or, when git ignores the page, like an agent's report in .scratch, a
+// file in the page's own folder or below. Never one in a .git folder. When git
+// can't answer, as for a file in a submodule or when git fails, the file stays out.
+async function inlineLocalFiles(html: string, page: string, root: string): Promise<string> {
+  const directory = dirname(page);
+  const inRepo = hasGitEntry(root);
+  // -v -n prints a line for every path git answers for, so a git that fails
+  // with no answer never counts as "not ignored". The "./" stops git reading a
+  // name like ":(glob)x" as a pattern.
+  const ignoreCheck = async (path: string): Promise<"ignored" | "kept" | "unknown"> => {
+    if (!inRepo) return "kept";
+    const { code, stdout } = await git(root, ["check-ignore", "-v", "-n", "--", `./${relative(root, path).split(nodePath.sep).join("/")}`]);
+    if (!stdout.trim()) return "unknown";
+    return code === 0 ? "ignored" : code === 1 ? "kept" : "unknown";
+  };
+  const pageIgnored = (await ignoreCheck(page)) === "ignored";
+  const allowed = async (file: string) => {
+    if (inGitFolder(relative(root, file))) return false;
+    if ((await ignoreCheck(file)) === "kept") return true;
+    return pageIgnored && !outside(relative(directory, file));
+  };
   let room = MAX_PREVIEW_BYTES - Buffer.byteLength(html);
   const inline = async (url: string, encode: (data: Buffer, file: string) => string): Promise<string | null> => {
     if (!url || /^([a-z][a-z0-9+.-]*:|[/\\#?])/i.test(url)) return null;
@@ -155,6 +176,7 @@ async function inlineLocalFiles(html: string, directory: string, root: string):
       const file = await realpath(resolve(directory, decodeURI(url.replace(/[?#].*$/, ""))));
       const stats = await stat(file);
       if (outside(relative(root, file)) || !stats.isFile() || stats.size > room) return null;
+      if (!(await allowed(file))) return null;
       const encoded = encode(await readFile(file), file);
       if (encoded.length > room) return null;
       room -= encoded.length;

package/server/paths.ts

@@ -7,14 +7,26 @@ export function outside(inside: string): boolean {
   return inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside);
 }
 
-// The worktree root is the nearest directory with a `.git` entry (a folder in
-// a checkout, a file in a linked worktree). Outside git, use the directory.
-// The command and the panel both start from here, so a Paseo project set at a
-// subfolder of the repo still reads the file the agent writes.
+// Whether a path from relative(root, target) is in a .git folder, a nested
+// checkout's included. Windows writes either separator, and Windows and macOS
+// match names in any case.
+export function inGitFolder(inside: string): boolean {
+  return inside.split(/[\\/]/).some((name) => name.toLowerCase() === ".git");
+}
+
+// A `.git` entry: a folder in a checkout, a file in a linked worktree.
+export function hasGitEntry(directory: string): boolean {
+  return existsSync(join(directory, ".git"));
+}
+
+// The worktree root is the nearest directory with a `.git` entry. Outside git,
+// use the directory. The command and the panel both start from here, so a
+// Paseo project set at a subfolder of the repo still reads the file the agent
+// writes.
 export function findRoot(cwd: string): string {
   let directory = resolve(cwd);
   while (true) {
-    if (existsSync(join(directory, ".git"))) return directory;
+    if (hasGitEntry(directory)) return directory;
     const parent = dirname(directory);
     if (parent === directory) return resolve(cwd);
     directory = parent;

package/server/store.ts

@@ -5,30 +5,24 @@
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
-import { appendFile, mkdir, readdir, readFile, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { basename, dirname, join, normalize, resolve } from "node:path";
+import { basename, dirname, join, normalize, resolve, sep } from "node:path";
 import { promisify } from "node:util";
-import { LEGACY_FOLDER, PANEL_OPENED_NAME, PROGRESS_FILE_NAME } from "../shared/events.ts";
-import { withLock } from "./lock.ts";
-import { outside } from "./paths.ts";
+import { latestRun, parseProgress } from "../shared/dashboard.ts";
+import { hasGitEntry, inGitFolder, outside } from "./paths.ts";
 
-const LOCK_NAME = `${PROGRESS_FILE_NAME}.lock`;
 const SAVE_RUNS_KEY = "paseo-progress.saveRuns";
-// Exactly what 0.1.x wrote into .scratch/.gitignore. Only this is ever removed.
-const LEGACY_GITIGNORE = `# Added by the progress plugin for Paseo so its files stay out of git.
-${PROGRESS_FILE_NAME}
-${LOCK_NAME}/
-${PANEL_OPENED_NAME}
-.gitignore
-`;
 
 // `directory` holds the working files. `shown` names it for people.
 export type Store = { directory: string; shown: string };
 
-export async function git(cwd: string, args: string[]): Promise<{ code: number; stdout: string }> {
+// Git runs in the worktree through -C, started from the folder Node itself
+// lives in: Windows looks for a program in the folder it starts in before
+// PATH, and a cloned repo can commit a git.exe.
+export async function git(root: string, args: string[]): Promise<{ code: number; stdout: string }> {
   try {
-    const { stdout } = await promisify(execFile)("git", args, { cwd });
+    const { stdout } = await promisify(execFile)("git", ["-C", resolve(root), ...args], { cwd: dirname(process.execPath) });
     return { code: 0, stdout };
   } catch (error) {
     const failed = error as { code?: number | string; stdout?: string };
@@ -36,10 +30,6 @@ export async function git(cwd: string, args: string[]): Promise<{ code: number;
   }
 }
 
-async function exists(path: string): Promise<boolean> {
-  return Boolean(await stat(path).catch(() => null));
-}
-
 // The plugin's per-user folder on this computer.
 export function stateRoot(home = homedir()): string {
   return join(home, ".local", "state", "paseo-progress");
@@ -68,76 +58,37 @@ export function outsideDirectory(root: string, home = homedir()): string {
   return join(stateRoot(home), `${basename(real)}-${hash}`);
 }
 
-// Whether git tracks a 0.1.x progress file, per worktree, until the file changes.
-const trackedLegacy = new Map<string, { mtimeMs: number; tracked: boolean }>();
-
-async function legacyTracked(root: string, mtimeMs: number): Promise<boolean> {
-  const cached = trackedLegacy.get(root);
-  if (cached && cached.mtimeMs === mtimeMs) return cached.tracked;
-  const { code } = await git(root, ["ls-files", "--error-unmatch", "--", `${LEGACY_FOLDER}/${PROGRESS_FILE_NAME}`]);
-  trackedLegacy.set(root, { mtimeMs, tracked: code === 0 });
-  return code === 0;
-}
-
-// The worktree's working files. A run 0.1.x left in .scratch moves outside the
-// first time anything asks, unless git tracks it: then it stays and is used in
-// place, so nothing changes for a repo that commits it.
-export async function findStore(root: string, home = homedir()): Promise<Store> {
+// The worktree's working files, always outside the repo. Progress never reads
+// a repo's .scratch, where 0.1.x kept them: a cloned repo could put anything there.
+export function findStore(root: string, home = homedir()): Store {
   const directory = outsideDirectory(root, home);
-  const store = { directory, shown: directory.startsWith(home) ? `~${directory.slice(home.length)}` : directory };
-  const legacy = join(root, LEGACY_FOLDER);
-  const info = await stat(join(legacy, PROGRESS_FILE_NAME)).catch(() => null);
-  if (!info) return store;
-  if (await legacyTracked(root, info.mtimeMs)) return { directory: legacy, shown: LEGACY_FOLDER };
-  await moveLegacy(legacy, directory);
-  return store;
-}
-
-// Appends the old file's lines to the new one rather than replacing it, so a
-// command that wrote to the old place mid-move loses nothing: the next move
-// picks those lines up. Then tidies what 0.1.x left behind.
-async function moveLegacy(legacy: string, directory: string): Promise<void> {
-  await mkdir(directory, { recursive: true });
-  await withLock(join(legacy, LOCK_NAME), async () => {
-    const text = await readFile(join(legacy, PROGRESS_FILE_NAME), "utf8").catch(() => null);
-    if (text === null) return;
-    await withLock(join(directory, LOCK_NAME), async () => {
-      const current = await readFile(join(directory, PROGRESS_FILE_NAME), "utf8").catch(() => "");
-      const lead = current && !current.endsWith("\n") ? "\n" : "";
-      await appendFile(join(directory, PROGRESS_FILE_NAME), `${lead}${text}`);
-    });
-    await rm(join(legacy, PROGRESS_FILE_NAME));
-    if (await exists(join(legacy, PANEL_OPENED_NAME))) {
-      await writeFile(join(directory, PANEL_OPENED_NAME), "");
-      await rm(join(legacy, PANEL_OPENED_NAME));
-    }
-  });
-  const ignore = await readFile(join(legacy, ".gitignore"), "utf8").catch(() => null);
-  if (ignore === LEGACY_GITIGNORE) await rm(join(legacy, ".gitignore"));
-  // Only if nothing else is in there; the user's own files keep the folder.
-  await rmdir(legacy).catch(() => {});
+  return { directory, shown: directory.startsWith(home) ? `~${directory.slice(home.length)}` : directory };
 }
 
 // The repo's saved-history folder, kept in its local git config, which every
 // worktree of the repo shares and nothing commits. Polls cost one stat; git
-// runs again only when the config file changes.
-const configFiles = new Map<string, string | null>();
+// runs again only when the config file changes. A worktree with no .git
+// entry is no repo; when git fails in one that has it, the next poll asks again.
+const configFiles = new Map<string, string>();
 const savedFolders = new Map<string, { mtimeMs: number; folder: string | null }>();
 
 async function configFile(root: string): Promise<string | null> {
+  if (!hasGitEntry(root)) return null;
   if (!configFiles.has(root)) {
     const { code, stdout } = await git(root, ["rev-parse", "--git-common-dir"]);
-    configFiles.set(root, code === 0 ? join(resolve(root, stdout.trim()), "config") : null);
+    if (code !== 0) return null;
+    configFiles.set(root, join(resolve(root, stdout.trim()), "config"));
   }
   return configFiles.get(root)!;
 }
 
-// Whether the worktree is in a git repo, which saving run history needs.
+// Whether git answers for the worktree's repo, which saving run history needs.
 export async function inGitRepo(root: string): Promise<boolean> {
   return (await configFile(root)) !== null;
 }
 
-// The folder runs are saved to, relative to the worktree root, or null.
+// The folder runs are saved to, relative to the worktree root, or null. A
+// folder set outside Paseo gets the same check as one picked in it.
 export async function historyFolder(root: string): Promise<string | null> {
   const file = await configFile(root);
   if (file === null) return null;
@@ -145,7 +96,8 @@ export async function historyFolder(root: string): Promise<string | null> {
   const cached = savedFolders.get(file);
   if (cached && cached.mtimeMs === mtimeMs) return cached.folder;
   const { stdout } = await git(root, ["config", "--get", SAVE_RUNS_KEY]);
-  const folder = stdout.trim() || null;
+  const checked = checkFolder(stdout);
+  const folder = "folder" in checked ? checked.folder : null;
   savedFolders.set(file, { mtimeMs, folder });
   return folder;
 }
@@ -156,7 +108,7 @@ export function checkFolder(raw: string): { folder: string } | { error: string }
   if (!trimmed) return { error: "Choose a folder" };
   const folder = normalize(trimmed);
   if (outside(folder) || folder === ".") return { error: "Choose a folder inside the repo" };
-  if (folder === ".git" || folder.startsWith(".git/")) return { error: "Choose a folder outside .git" };
+  if (inGitFolder(folder)) return { error: "Choose a folder outside .git" };
   return { folder };
 }
 
@@ -189,27 +141,32 @@ export function runFileName(startedAt: string, title: string): string {
 export async function saveRunCopy(root: string, text: string): Promise<void> {
   const folder = await historyFolder(root);
   if (!folder) return;
-  const lines = text.split("\n").filter((line) => line.trim());
-  let start = -1;
-  let event: { ts?: string; title?: string } | null = null;
-  for (let index = lines.length - 1; index >= 0; index--) {
-    try {
-      const parsed = JSON.parse(lines[index]);
-      if (parsed?.type === "run.start") {
-        start = index;
-        event = parsed;
-        break;
-      }
-    } catch {}
+  // The run the dashboard shows. A start line it can't read is no run.
+  const [start] = latestRun(parseProgress(text).events);
+  if (start?.event.type !== "run.start") return;
+  const lines = text.split("\n").slice(start.line - 1).filter((line) => line.trim());
+  const directory = await runsFolder(root, folder);
+  if (!directory) return;
+  // A rename replaces a link at the run's file instead of writing through it.
+  await writeAtomic(join(directory, runFileName(start.event.ts, start.event.title)), `${lines.join("\n")}\n`);
+}
+
+// The saved-runs folder in the real worktree, made one step at a time, or null
+// when any step is a link or a file: a cloned repo can commit a link that leads
+// out of it.
+async function runsFolder(root: string, folder: string): Promise<string | null> {
+  let directory = await realpath(root);
+  for (const name of folder.split(sep)) {
+    directory = join(directory, name);
+    const info = await lstat(directory).catch(() => null);
+    if (!info) await mkdir(directory);
+    else if (!info.isDirectory()) return null;
   }
-  if (start < 0 || !event?.ts || !event.title) return;
-  const directory = join(root, folder);
-  await mkdir(directory, { recursive: true });
-  await writeFile(join(directory, runFileName(event.ts, event.title)), `${lines.slice(start).join("\n")}\n`);
+  return directory;
 }
 
 // The folders directly inside one folder of the worktree ("" is the top), for
-// the folder picker. .git is left out; so are links, which could leave the repo.
+// the folder picker. .git folders are left out; so are links, which could leave the repo.
 export async function listFolders(root: string, folder: string): Promise<{ folder: string; folders: string[] }> {
   const checked = folder === "" ? { folder: "" } : checkFolder(folder);
   if ("error" in checked) throw new Error(checked.error);
@@ -217,6 +174,6 @@ export async function listFolders(root: string, folder: string): Promise<{ folde
     if (error.code === "ENOENT") return [];
     throw error;
   });
-  const folders = entries.filter((entry) => entry.isDirectory() && !(checked.folder === "" && entry.name === ".git")).map((entry) => entry.name);
+  const folders = entries.filter((entry) => entry.isDirectory() && !inGitFolder(entry.name)).map((entry) => entry.name);
   return { folder: checked.folder, folders: folders.sort((a, b) => a.localeCompare(b)) };
 }

package/shared/events.ts

@@ -7,8 +7,6 @@ import { QUESTION_MODES } from "./question-modes.ts";
 export const PROGRESS_FILE_NAME = "progress.jsonl";
 // Present once someone has opened the Progress panel for this worktree.
 export const PANEL_OPENED_NAME = "progress-panel-opened";
-// Where 0.1.x kept each worktree's files. store.ts moves them out.
-export const LEGACY_FOLDER = ".scratch";
 export const EVENT_VERSION = 1;
 
 export const TICKET_STATUSES = ["not_started", "working", "blocked", "done", "skipped"] as const;